In this General Privacy Notice, the following terms are used with their respective meaning:

"Personal Data"	means information which — (a) is processed by means of equipment operating automatically in response to instructions given for that purpose; (b) is recorded with intention that it should be processed by means of such equipment; (c) is recorded as part of a relevant filing system;(d) where it does not fall under paragraphs (a) (b) or (c), forms part of an accessible record; or (e) is recorded information which is held by a public entity and does not fall within any of paragraphs (a) to (d)
"Sensitive Data"	means data revealing the natural person's race, health status, ethnic social origin, conscience, belief, genetic data, biometric data, property details, marital status, family details including names of the person's children, parents, spouse or spouses, sex or the sexual orientation of the data subject;
"Health Data"	means data related to the state of physical or mental health of the data subject and includes records regarding the past, present or future state of the health, data collected in the course of registration for, or provision of health services, or data which associates the data subject to the provision of specific health services;
"Data Subject"	means an identified or identifiable natural person who is the subject of personal data i.e. Students, Prospective Students, Students' Representatives;
"Data Processing"	means any operation or sets of operations which is performed on personal data whether or not by automated means, such as (a) collection, recording, organisation, structuring; (b) storage, adaptation or alteration; (c) retrieval, consultation or use; (d) disclosure by transmission, dissemination, or otherwise making available; or (e) alignment or combination, restriction, erasure or destruction.
"Data Protection Act"	refers to the Data Protection Act of the Republic of Kenya, 2019 (”DPA”);
"Students"	refers to the individuals (considered children whenever under 18 years old and considered youth whenever exceeding 18 years old) enrolled in Academic and non-academic courses, extracurricular activities or services rendered by the school
"Prospective Students"	refers to Prospective Students who will potentially be enrolled at the School;
"Student's Representative"	refers to the individual(s) legally responsible for the Student(s) or Prospective Student(s) i.e. the Student’s parent or legal guardian;
"Consent"	means any manifestation of express, unequivocal, free, specific and informed indication of the data subject's wishes by a statement or by a clear affirmative action, signifying agreement to the processing of personal data relating to the data subject; Consent will be provided by the Student's Legal representative when the Student is a child. Consent shall be provided solely by the Student who is youth i.e. above 18 years old.
"Online Platform"	means any website and/or online platform provided by the School;
"The School"	means SABIS® International School - Runda, Kenya a company incorporated under Kenya law to provide educational services to students enrolled at the School;
"Personal Data Breach"	means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

 

 

For the purposes described in this General Privacy Notice, the School shall be taken as the legal person responsible for determining the purposes and means of the Personal Data that had been submitted by Students, Prospective Students, Students' Representatives, and may be identified and contacted through the channels below:

• School's address: SABIS^® International School Runda, Kenya. Off Kiambu Road
• Data Protection Officer Email: (info@kkkasociates.co.ke)
• Telephone Number: (+254 724 484 286)

 

 

As part of its educational activities, the School will collect and process the Personal Data identified below, with the following purpose and legal basis:

                                                                           

Student, Prospective Student, and Students' Representatives' Identification Data: Types of data that enable the identification of the Data Subject who has any legal bond with the School - Students, Prospective Students, Students' Representatives- consisting, for example, of full name, date of birth, nationality, place of birth, profession, home address, E-mail address, postal code, and telephone and/or cell phone number(s) along with vital statistics, vaccinations, passport copies.

Purpose: The Personal Data is collected in order to enable the proper identification of Students, Prospective Students, Students' Representatives, that either have established or will establish a contractual relationship with the School.

Legal Basis: The processing of Identification Data by the School will be carried out in order to allow the controller to perform the tasks and services described in the contract to which the Data Subject is a party.

 

Students' Representative Financial Data: Personal Data that allows the School to perform bank collection or compensation for the educational services provided or for the registration of Students or Prospective Students, consisting, for example, of bank details, payment information, and credit card details of the Students' Representative.

Purpose: Student's Representative Financial data is collected to enable the School to properly and securely charge for its services.

Legal Basis: Student's Representative Financial data will be processed due to the need for the School to execute, or be allowed to execute, the contract in which the Data Subject takes part,

 

Data Concerning Health: Personal Data relating to certain health conditions of Students and Prospective Students. Including vaccination records where applicable.

Purpose: Data concerning the health of Students, Prospective Students is collected to enable the School to render appropriate medical treatment when and if necessary, either during or before the execution of the enrollment contract, as a preparatory measure by the School for the timely provision of services.

Legal Basis: This type of data will always be processed in the best interest of Students and Prospective Students, with the consent of at least one of their Representatives , pursuant to the purposes listed above.

 

Student Performance Data: Data related to the Student's pedagogical performance, consisting, for example, of disciplinary and educational observations, evaluations, tests, reports of grades, and absences.

Purpose: Performance Data is collected to allow Students, their Representatives, and the School to be aware of the Student's pedagogical performance. Amongst the intended purposes are (i) supporting Student learning; (ii) monitoring Student learning performance; (iii) managing the educational services provided by the School to Students; and (iv) compliance with legal and regulatory obligations, which determine, for example, the measurement of Student grade averages and attendance.

Legal Basis: The processing of Performance Data by the School will be carried out in order to allow the School to perform the tasks and services described in the contract to which the Data Subject is a party.

 

Photography and Filming: Images of Students' and Prospective Students'.

Purpose: The images are collected in order to allow the School to properly identify its Students, Prospective Students during or prior to the provision of educational services, as well as to implement appropriate security measures on the school premises, via the CCTV system and others.

Legal Basis: Images of Students, Prospective Students will be processed by the School when at least one of their “Representatives" grants consent to do so.

 

CCTV System: Footage collected from the School's perimeter hallway, sports fields, auditorium, cafeteria and other relevant building cameras video surveillance systems:

Purpose: The purpose of collecting Personal Data from the CCTV system include: 1. To control access to the School premises and to ensure its security, the safety of the Students, Employees and visitors, as well as property and information located or stored on the premises; 2. To prevent, deter, and if necessary, investigate unauthorized physical access, including unauthorized access to secure premises and protected rooms, IT infrastructure, or operational information; 3. To prevent, detect, and investigate a theft of equipment or assets owned by the School, visitors or staff or threats to the safety of personnel working at the School (e.g. fire, physical assault). It is important to note that the location and positioning of the video cameras are such that they are not intended to cover the surrounding public space; the cameras are aimed to give a general overview of what`s happening in certain places, but not to recognize persons. The cameras are installed at the School entrances, and placed and focused in a way that only people who want to access the site or the annexed facilities including parking areas property are filmed. The cameras cover the area of entry and exit points of the building, entry points inside the building, delivery, garage, parking and all outer area of the building. The recorded material can be accessed by the security staff members of the School. Access to the hard-disc recorder is highly limited, being protected by a password and recording any log or action from the staff members. The data cannot be accessed without the authorization of the School Director, the School's Head of Administration or a member of the School Management. The recorded material is kept for 14 days after the Data Subject visits the School. After that period, any recorded material is automatically overwritten. The recorded material may be kept for a longer period in the event they are related to an incident, crime or an event which would lead to a future prosecution. The School does not share Personal Data captured on CCTV with any third party unless the Data Subject has provided permission or there is a specific request from the police or other law enforcement authorities. If Personal Data is shared with a third party, the Data Subject will be notified.

Legal Basis: The video CCTV system is used based on a legitimate interest for the safety and well-being of the Students and the School's personnel.

 

Direct Marketing: Students, Prospective Students, and their Representatives may be asked to provide Personal Data, such as their name and E-mail address, for the purpose of receiving marketing communications by E-mail.

Purpose: The Personal Data provided is used to provide school-related information to the Data Subject, who will be asked to affirmatively opt-in to E-mail marketing communications.

Legal Basis: Consent to receive marketing material.

 

The School shall only collect data for specific purposes and with a proper legal basis for processing. Data obtained for specific purposes will not be processed for purposes different from the ones specified in this policy unless the School properly notifies Data Subjects regarding it.

The collection of Personal Data occurs in the following cases:

Data Provided by the Data Subject:

• Voluntary completion of registration forms, applications, or vacancy forms per Student's Representative;

• Direct contact by E-mail, telephone, or any other form of electronic correspondence and/or letters;

• The Student or his/her Holder of Responsibility voluntarily creates a profile on any of the School's Online Platforms;

• Through the completion of electronic or paper forms, evaluations, reports, tests, simulations, notes, and attendance lists, as well as taking part in interviews and meetings, all of which are deemed a necessary part for the educational services contracted and are submitted by the Student, the Student's Representative to one of the School's agents.

 

Internet Trackers:

  The Data Subject's personal information is electronically collected for statistical purposes and for the improvement of the School website, using cookies (files stored in the Data Subject's browser). The School and its service providers may also use other tracking technologies for website management and user tracking.

 

Online Platforms:

The School uses Online Platforms during the rendering of its educational services and, therefore, provides its students access to software that is not operated by the School. Please note that this Privacy Policy does not apply to third-party software. This Privacy Policy does not govern the practices of third parties, including the School's partners, third-party service providers, and/or advertisers, even when those services are branded as or provided on behalf of the School.

 

Third Parties:

This consists of the collection of Personal Data that is provided by and/or shared with authorized third parties or government agencies, including:

• Doctors, therapists, speech therapists, and other health professionals, always with the consent of the Student's Representative and in his/her best interest;

• Other educational establishments;
• Government bodies and regulatory authorities.

In case of medical emergencies, the Personal Data of Data Subjects may be collected without consent and its processing will be carried out exclusively for the protection of the Data Subjects.

Personal Data from third parties will be properly analyzed by the School in order to ensure that the information has been collected and is being shared on a legal and/or regulatory basis and is accurate and up to date.

 

 

The School is not responsible for, nor does it hold any interference with, any filming or photographs made by Students, Prospective Students, and their Representatives during the regular School day activities or social events organized by the School.

However, in order to provide a healthy environment for its Students, the School will publicize guidelines among its members, students, and representatives on sharing images and footage of minors, reminding all those participating in the School environment of the provisions in this General Privacy Notice, including:

• Reminding Students' and their Representatives about their option of updating their consent preferences for any data processing operation involving the Students.

• Requesting that photographs and footage of Students that are taken during the School's social events must not be shared on social media without prior authorization from the Student's Representative

• Reminding Students and their Representatives about the terms of this General Privacy Notice.

 

The School recognizes the need to safeguard the Personal Data and the privacy of its Students and both at school and on social media.

Under the terms of the enrollment contract signed between the School and the Student(s)' Representative(s), the School is authorized to use the Student's image, by means of photographs, videos, and/or recordings, for the purpose of publicizing the educational services provided on Online Platforms and general media, always in the best interest of the Student and the legitimate interest of the School.

The School recognizes the need to protect the Personal Data and privacy of its Students, both at school and on social media, and, therefore, will only use the image of Students with the consent of their Representative(s), which will be collected from at least one of the Representatives through a specific form.

 

The processing of Students' Personal Data will be restricted to the purposes outlined above in Clause 3 and in accordance with this General Privacy Notice

 

Access to the Personal Data of Students, Prospective Students, and their Representatives will be restricted to professionals and agents assigned to the specific function of developing the process of enrollment, selection, and rendering of educational services provided by the School.

 

The School takes advanced administrative, technical, organizational, and physical measures to protect the Personal Data under its control. These measures include computer protection mechanisms and secure files and facilities. In turn, once the purpose of the data processing is fulfilled, the School adopts appropriate measures to securely delete or permanently dissociate the Personal Data, depending on the applicable legislation and compliance with the minimum data retention principle

The School will only keep Personal Data for as long as necessary to process Students' and Prospective Students' applications unless it is necessary to retain it for an underlying period, which will be done on the basis of the provisions of the DPA.

The School reserves the right to contract third parties - Processors - to carry out the storage of Personal Data under its custody, in which case these agents will have to process the Personal Data of prior written instructions determined by the School and to ensure the confidentiality and security of Personal Data.

 

The school does not share Personal Data with any third parties, unless in the following situations:

• With public regulatory or executive authorities, courts, and government agencies to comply with legal orders, legal or regulatory requirements;

• With Service Providers ("Processors"), regulatory authorities, and government agencies to detect and prevent fraud or other criminal activity and to protect the rights of the School or others;

• With “Processors" for the execution of contracts and business development at the request of the School.

When Personal Data of Students, Prospective Students, Representatives and has to be shared with third parties other than as described above, the School will notify the Data Subject to obtain consent for that purpose, subject to exceptions provided in applicable law.

Accordingly, the School reserves the right to store Personal Data under its custody with Processors who may or may not be located in the Republic of Kenya territory. When Personal Data is transferred to other jurisdictions, the recipient of such information will always be countries or international organizations capable of providing an adequate degree of protection.

As the School is a member of the SABIS^® School Network, the Personal Data may be transferred outside the territory of the Republic of Kenya and securely replicated to the databases located in Microsoft Azure Cloud Services in Ireland and SABIS Educational Systems Inc. in the United States. This is done to provide the Students and their Representatives access to SABIS^® Applications and to support Students' learning by monitoring and following up on their academic and non-academic performance, including but not limited to exam results, attendance and discipline records, school calendar, study material, and Student Life Organization (SLO) participation. The replicated Personal Data will also be used to run analytics/statistics on Students, sections, classes, and overall School's academic performance.

Further to the School's requests and instructions, authorized employees in SABIS Educational Services S.A.L., Lebanon and SABIS Educational Systems Inc. have access to the replicated Personal Data in order to operate, develop, improve, deliver, or troubleshoot the Online Platform and provide and support the School with various technical and educational services.

 

According to the DPA, Data Subjects have rights in relation to the processing of their Personal Data, among them:

• to be informed of the use to which their personal data is to be put;

• to access their personal data in custody of data controller or data processor;

• to object to the processing of all or part of their personal data;

• to correction or false or misleading data;

• to deletion of false or misleading data about them.

• to withdraw the consent at any time.

If the Data Subjects choose to exercise any of the rights described above, or if they have any questions about how the processing of their Personal Data flows, they may contact the School's Data Protection Officer through the channels highlighted in Item 2 of this General Privacy Notice.

The Student's, Prospective Students and the Student's Representative(s) is (are) responsible for the accuracy of the information provided during the registration process with the School.

The School reserves the right to amend or modify this General Data Privacy Notice at any time, considering, but not limited to, legislative, regulatory, and case law updates.

In the event of a change to the terms set forth herein, the School will notify the Student, Prospective Student and their Representatives, detailing the changes and, if applicable, requesting an update of consent for the processing of Student's data.

If you have any questions, please contact us through the channels provided in Item 2 of this Privacy Notice.